Headline
CVE-2021-45007: CVE-2021-45007/README.md at main · AS4mir/CVE-2021-45007
Plesk 18.0.37 is affected by a Cross Site Request Forgery (CSRF) vulnerability that allows an attacker to insert data on the user and admin panel.
Permalink
Cannot retrieve contributors at this time
CVE-2021-45007
Cross-Site Request Forgery
Cross-Side Request Forgery (CSRF)
Affected product and version: Plesk CMS 18.0.37
Severity: High
Impact: Submit requests with attacker information
Description: CSRF could let the attacker to submit requests because there isn’t any CSRF_token protection sent with requests to server.
Steps to reproduce:
Login and try to submit any request
Capture the request with burp suite
Will note that there isn’t any token protection sent with request to server
Write simple html exploit to submit request
Open it in browser
Submit the request
Will find that your data are submitted successfully
